<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>dmitriiev.dev</title><description>Bug bounty notes. Technique over journey.</description><link>https://dmitriiev.dev/</link><item><title>When the main app is clean, go count the URL fetchers</title><link>https://dmitriiev.dev/posts/ssrf-at-the-edges/</link><guid isPermaLink="true">https://dmitriiev.dev/posts/ssrf-at-the-edges/</guid><description>The core product passes every check, so you move on. The SSRF was in a side feature nobody armored: one of the half-dozen places the backend quietly fetches a URL on your behalf.</description><pubDate>Wed, 17 Jun 2026 00:00:00 GMT</pubDate></item><item><title>Your bug is real. Your report reads like ChatGPT. That&apos;s why it got closed.</title><link>https://dmitriiev.dev/posts/anti-ai-tells/</link><guid isPermaLink="true">https://dmitriiev.dev/posts/anti-ai-tells/</guid><description>Triagers now bounce AI-shaped reports on sight, valid or not. Here are the tells they pattern-match, and how to write so a human believes you.</description><pubDate>Sat, 13 Jun 2026 00:00:00 GMT</pubDate></item></channel></rss>